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Amendments to the Specification: 

Please replace the numbered paragraphs with the changes as indicated below. 

[0002] This application discusses concepts in particular embodiments that are related to 
patent application 09/696,893 filed 26 October 2000 entitled METHOD AND APPARATUS 
FOR NETWORK DECEPTION/EMULATION, which claims priority from provisional 
patent application 60/165,581 filed November 15, 1999. This application discusses concepts 
in particular embodiments that are related to patent application 60/380,824 entitled 
METHOD AND APPARATUS FOR AN INVISIBLE ROUTER. This application discusses 
concepts in particular embodiments that are related to patent application A/N 10/678,609 
entitled METHOD AND APPARATUS PROVIDING DECEPTION AND/OR ALTERED 
EXECUTION OF LOGIC IN AN INFORMATION SYSTEM filed on the same date as this 
application. Each of these applications and all documents referred to therein are hereby 
incorporated by reference. 

[0010] Protecting information systems from various forms of attack has long been of 
concern to practitioners in the field. Some forms of protection are built into operating 
systems, such as user and/or password authentication. Other forms of protection include 
various software and sometimes hardware strategies. A very commonly used form of 
protection is anti-virus software. Inventor Fred Cohen, as early as 1988, proposed and 
implemented an integrity shell, which was a program that run in an operating system kernel 
space and used a modified execution system call to verify a check sum over every program 
before executing that program. Such a modified system call allowed the system to protect 
against viruses that hid within executable components, because the presence of such viruses 
would change the checksum of those executable components. Further information about this 
work is available athttp:/{/)/{/)all.net/i/lbooks/{/)integ/{/)vmodels.html. 
[0011] It is believed to be generally known to modify parts of an operating system, 
including parts of kemel system calls, for various reasons. In some cases, modified system 
calls will preserve original system calls in order to remove modifications or in order to run 
original system calls after the modified portion is mn. For example, such techniques are 
discussed in "The Linux Kemel Module Programming Guide" by Ori Pomerantz, believed 
available 1999-05-19. (see www.tldp.org/i/)LDP/{/)lkmpg/{/)node20.html.) 
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[0012] Various strategies used in computer systems have at times included providing 
some type of misinformation. Some logic modules, for example, are designed to hide 
themselves from various operating system functions, such as process viewing functions, and 
thus can cause functions to provide a list of processes and(/)or files and(/)or users, for 
example, that are not complete. One use of such a strategy is mentioned in the context of a 
program referred to as the Kernel Intrusion System. This program is described as a kernel 
level rootkit that, among other things, makes modifications to the kernel to get some 
privileges, and hides itself from system administrators. Further information is available at 
www .packetstormsecuritv.org/(/)UNIX /(/)penetration/(/) rootkits/{/)kis- 0 . 9 . tar . gz . 
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